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Two protocols of quantum direct communication with authentication [Phys. Rev. A 73, 042305 
(2006)] are recently proposed by Lee, Lim and Yang. In this paper we will show that in the two 
protocols the authenticator Trent should be prevented from knowing the secret message of commu- 
nication. The first protocol can be eavesdropped by Trent using the the intercept-measure-resend 
attack, while the second protocol can be eavesdropped by Trent using single-qubit measurement. 
•^T To fix these leaks, I revise the original versions of the protocols by using the Pauli-Z operation a z 

^^ ' instead of the original bit-flip operation A. As a consequence, the protocol securities are improved. 

(SJ ■ PACS: 03.67. Dd 
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£V1 . Quantum key distribution (QKD) is one of the most interesting topics in quantum information pro- 

cessing, which provides a novel way for two legitimate parties to share a common secret key over a long 
distance with negligible leakage of information to an eavesdropper Eve. Its ultimate advantage is the 
unconditional security. Hence, after Bennett and Brassard's pioneering work published in 1984[1], much 
attentions have been focused on this topic and a variety of quantum communication protocols[l-13, 17-18] 
have been proposed. In these works, various properties of quantum mechanics, such as no-cloning theo- 
rem, uncertainty principle, entanglement, indistinguishability of nonorthogonal states, non-locality, and 
so on, are used to accomplish QKD tasks. Different from QKD, the deterministic quantum secure direct 






communication (QSDC) protocol is to transit directly the secret messages without first generating QKD 
to encrypt them. Hence it is very useful and usually desired, especially in some urgent time. However, 
a deterministic secure direct communication protocol is more demanding on the security. Therefore, 
only recently a few of deterministic secure direct communication protocols have been proposed [3- 12] 
and some of them are essentially insecure [13- 15]. Two of the QSDC protocls are the Lee-Lim-Yang 
protocols of quantum direct communication with authentication [12] proposed very recently by Lee, Lim 
and Yang using the Greenberg-Horne-Zeilinger (GHZ) states[16]. Based on some security analysis Lee, 
Lim and Yang claimed that their two protocols are secure. However, in this paper we will show that 
in the two protocols the authenticator Trent should be prevented from knowing the secret message of 
communication. The first protocol can be eavesdropped by Trent using the the intercept-measure-resend 
attack, while the second protocol can be eavesdropped by Trent using single-qubit measurement. I will 
fix these leaks by modifying the original versions of the protocols using that Pauli-Z operation a z instead 
of the original bit-flip operation X so that the protocol securities are improved. 

There are three parties in each of the Lee-Lim-Yang protocols. Alice and Bob are the legitimate 
users of the communication. Trent is the third party who is introduced to authenticate the two users 
participating in the communication. Trend is assumed to be more powerful than the other two parties 
and he supplies the GHZ states each in the form of |\I/) = (|000) + | 111) )/a/ / 2- The protocols are 
composed of two parts: one is for an authentication process and the other is for a direct communication. 
The authentication process is same for both Lee-Lim-Yang protocols. After the authentication, there 
are two possibilities for Alice to send qubits: one is to Bob and the other is to Trend. The former 



case corresponds to the Lee-Lim-Yang protocol 1 and the latter case to the Lee-Lim-Yang protocol 2. 
This is a difference between the two protocols. Incidentally, there is an unphysical mistake about the 
respondences in the text of Rcf.[12]. 

The purpose of the authentication process in the Lee-Lim-Yang protocols is to let the three participants 
safely share GHZ states. To achieve this goal, it is assumed that Trend should share in priori secret 
authentication keys K ta and K^ with Alice and Bob, respectively. The lengths of the authentication 
keys Kta and Ktb are larger than the length of the bit string of the secret message which will be 
communicated from Alice to Bob. According to the one-time pad cryptography, when the private key 
length is equal to the secret message length, the secret message can be securely communicated to remote 
places after encryption. If Trend is not assumed to prevent from knowing the secret message, then in 
this case the secret message can be transferred in the following very simple classical way instead of 
using the Lee-Lim-Yang QSDC protocols, i.e, Alice can securely send the secret message to Trend by 
using their secret authentication key K ta and then Trend can securely send the secret message to Bob 
by using their secret authentication key K t b- Hence, in the Lee-Lim-Yang protocols the third party 
Trend should be prevented from knowing the secret message though he is introduced to authenticate 
the communication. 

Assume that the GHZ states are safely shared among the three parties after the authentication process. 
Let us now briefly review the second part of the Lee-Lim-Yang protocol 1. 

(a) Alice selects a subset of GHZ states of her remaining set after authentication and keeps it secret. 

(b) Alice chooses a random bit string which has no correlation to the secret message to transmit to 
Bob. This bit string will be used to check the security of the channel. 

(c) Following the random bit string, Alice performs unitary operations on the the qubits selected for 
check process. The unitary operations are defined as follows. The bit '0' correspond to H and the bit 
T' to HX, where H is the Hadamard operation and X is the bit-flip operation. The GHZ states after 
Alice's operations are transformed into: 



H A \V) = F a (|000)^ts + |1H)atb)/V2 

= ^{\000) ATB + \100) ATB + \0U)atb - \1H)atb} 

= \{(\<l> + )AB-\4>-)AB)\-)T + (\r)AB + W + )AB)\ + )T}, (1) 



H A X A Yi!) = H a {\100)atb + |011)atb)/V2 

= ^{|000) ATB - \100) ATB + \0H) ATB + |1H)aTb} 

= 1{(\4>-)ab-\^ + )ab)\-)t + (\^ + )ab + H-)ab)\+)t}, (2) 

where |</>±) = (|00) ± |ll»/>/2, |^ ± ) = (|01) ± |10))/V2 and |±) = (|0) ± |1))/V2. 

(d) Alice encodes the secret message with a classical error correction code on the remaining GHZ 
states in terms of the unitary operation definition in (c). 

(e) After making all unitary operations, Alice sends the encoded qubits to Bob. 

(f ) Bob makes Bell measurements on the pairs of particles consisting of his qubits and Alice's qubits. 

(g) Trent measures his third qubit in the x basis {|— ), |+)} and publishes the measurement outcomes, 
(h) Using Trend's measurement outcomes and his Bell-state measurement outcomes, Bob infers Alice's 

secret bits consisting of both the random bits and the secret message. 

(i) Bob lets Alice reveal the check bits' positions and values. 

(j) Bob can know whether the channel is disturbed according to the error rate. If the error rate is 
higher than expected, an eavesdropper is concluded in the communication but fortunately the secret 



message is not leaked out. If the error rate is lower, Bob can extract the secret message (see Table I in 
Rcf.[12]). 

As I show before, the authenticator Trent should be prevented from the secret message. Otherwise, 
the communication can be realized in a very simple classical way. Although the Lee-Lim-Yang protocol 
1 is claimed to be secure (that is, the secret message can not be leaked out), in the protocol 1 the insider 
Trent can eavesdrop the secret message by using the intercept-measure-resend attack. This can be seen 
as follows. When Alice sends her encoded qubits to Bob, Trent intercepts the qubits and performs H 
operation on each qubit. In this case, the whole states are transformed into 



H A H A \<S>) = (|000)atb + |1H)ats)/V2, (3) 

H A H A X A \$>) = (|100)ats + |011)atb)/\/2. (4) 



After the unitary operations, Trent measures Alice's qubit and his qubit in the z basis {|0), |1)}, respec- 
tively. If the two outcomes are same, then Trent can conclude that Alice has performed a H operation 
corresponding to the bit '0'. Otherwise, Alice has performed a HX operation corresponding to the 
bit '1'. In this case, Trent has already known for each Alice's qubit which unitary operation Alice has 
performed on. Alternatively, he has already got Alice's whole bit string including both the random bit 
string for check and the secret message. In the following what he needs to do is to remove the random 
bits. Fortunately, in the step (i), Alice will publish which qubits are used as check qubits. This means 
that the authenticator Trent can completely know the secret message using this intercept-measure-resend 
attack. 

After Trnent's attack, he sends Alice's qubits to Bob. One can easily find that for Alice an Bob the 
error rate will obviously be higher than expected. Unfortunately, Alice and Bob only know the channel 
is disturbed and still believe that the secret message is not leaked out. 

To fix this leak, we think the original version of Lee-Lim-Yang protocol 1 can be modified by using 
the Pauli-Z operation a z instead of the original bit-flip operation X. In this case, the total states after 
Alice's operations are represented as follows: 

H A \V) = F a (|000)^ts + |1H}atb)/\/2 

= ^{\000) AT b + \100) ATB + |011)atb - \1U) ATB } 

= \{{\^ + )AB-\i>-)AB)\-)T + (\^)AB + \^ + )AB)\+)T}, (5) 

H A a zA \V) = H A (\000) ATB - |lll) ATB )/\/2 

= \{\000)atb + \100) ATB - \0U)atb + \Hl) atb} 

= 1{(\^)ab + \^ + )ab)\-)t + (\^ + )ab-\^-)ab)\+)t}- (6) 

After this modification, if Trend intercepts Alice's encoded qubits and performs H operations, then the 
total states are transformed into 



H A H A \<S>) = (\000) atb + \m) ATB )/V2, (7) 

H A H A a zA \V) = (|000)^tb-|111)atb)/\/2. (8) 



If he measures respectively his qubit and Alice's qubit in the z basis, the outcomes will always be same. 
In this case, he can not know for each of Alice's qubits which unitary operation Alice has performed 
on. This means Trent can not know Alice's secret message. However, one can easily find that revised 
protocol works successfully as for as Alice and Bob's communication is concerned. See Table 1 for a 
brief summary. 



Table 1 The relation of Alice's operation, Bob's measureemnt, and Trent's announcement in the 

revised Lee-Lim-Yang protocol 1 can be summarized as follows. 

Trent's publication Bob's Measurement Alice's operation 
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Let us now briefly review the second part of the Lee-Lim-Yang protocol 2. Some steps are same for 
both protocols. Nevertheless, for completeness, I depict all the steps as follows. 

(a') Alice selects a subset of GHZ states of her remaining set after authentication and keeps it secret. 

(b') Alice chooses a random bit string which has no correlation to the secret message to transmit to 
Bob. This bit string will be used to check the security of the channel. 

(c') Following the random bit string, Alice performs unitary operations on the the qubits selected for 
check process. The GHZ states after Alice's operations are transformed into: 
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+ H + )at)\+)b}, (9) 



+ \i/>-)at)\+)b}. (10) 



(d!) Alice encodes the secret message with a classical error correction code on the remaining GHZ 
states in terms of the unitary operation definition in (c'). 

(e') After making all unitary operations, Alice sends the encoded qubits to Trent. 

(/') Trent makes Bell measurements on the pairs of particles consisting of his qubits and Alice's qubits 
and publishes the measurement outcomes. 

(<?') Bob measures his qubits in the x basis {|— ), |+)} . 

(h 1 ) Using Trend's Bell-state measurement outcomes and his measurement outcomes, Bob infers Alice's 
secret bits consisting of both the random bits and the secret message. 

(i r ) Bob lets Alice reveal the check bits' positions and values. 

(j') Bob can know whether the channel is disturbed according to the error rate. If the error rate is 
higher than expected, an eavesdropper is concluded in the communication but fortunately the secret 
message is not leaked out. If the error rate is lower, Bob can extract the secret message (see Table II in 
Rcf.[12]). 

In the protocol 2 the insider Trent can eavesdrop the secret message by using the measurement attack 
as follows. Trent performs H operation on each qubit he received from Alice. In this case, the whole 
states arc transformed into 



H A H A \^>) = (|000) at s + llll) at b)/V2, (11) 

H A H A X A \V) - (|100)^ts + |011)atb)/\/2. (12) 

After the unitary operations, Trent measures Alice's qubit and his qubit in the z basis {|0), |1)}, respec- 
tively. If the two outcomes are same, then Trent can conclude that Alice has performed a H operation 
corresponding to the bit '0'. Otherwise, Alice has performed a HX operation corresponding to the 
bit '1'. In this case, Trent has already known for each Alice's qubit which unitary operation Alice has 
performed on. Alternatively, he has already got Alice's whole bit string including both the random bit 



string for check and the secret message. In the following what he needs to do is to remove the random 
bits. Fortunately, in the step (i'), Alice will publish which qubits are used as check qubits. This means 
that the authcnticator Trent can completely know the secret message using this measurement attack. 

After Trnent's attack, he randomly publishes his measurement outcomes. One can easily find that for 
Alice an Bob the error rate will obviously be higher than expected. Unfortunately, Alice and Bob only 
know the channel is disturbed and still believe that the secret message is not leaked out. 

To fix this leak, the original version of Lee-Lim-Yang protocol 2 can also be modified by using the 
Pauli-Z operation a z instead of the original bit-flip operation X. In this case, the total states after 
Alice's operations arc represented as follows: 



H A \V) = H A (\000} ATB + \ni) ATB )/V2 

= 1{(\4> + )ab-H-)ab)\-)t + (\^-) A b + \^ + )ab)\+)t}, (13) 

H a <Tza\*) = H A (\000} ATB -\ni) AT B)/V2 

= 1{(\<P-)at + H + )at)\-)b + (\^ + ) A t~\^-)at)\+)b}. (14) 

After this modification, if Trend intercepts Alice's encoded qubits and performs H operations, then the 
total states are transformed into 

H A H A \V) = (|000)atb + |1H)ats)/V2, (15) 

H A H A a zA \V) = (\000) ATB -\ni) AT B)/V2. (16) 

If he measures respectively his qubit and Alice's qubit in the z basis, the outcomes will always be same. 
In this case, he can not know for each of Alice's qubits which unitary operation Alice has performed 
on. This means Trent can not know Alice's secret message. However, one can easily find that revised 
protocol works successfully as for as Alice and Bob's communication is concerned. See Table 2 for a 
brief summary. 

Table 2 The relation of Alice's operation, Bob's measureemnt, and Trent's announcement in the 
revised Lee-Lim-Yang protocol 2 can be summarized as follows. 
Trent's announcement Bob's Measurement Alice's operation 
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To summarize, in this paper we have shown that the Lee-Lim-Yang protocols can be eavesdropped 
by the authenticator Trent using some specific attacks and we have revised the original versions of the 
protocols by using the Pauli-Z operation a z instead of the original bit-flip operation X so that the 
protocol securities are improved. 
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